Stage 0: migrate pipeline scripts from /opt/sldl, scaffold repo

Moves all ~30 pipeline scripts, configs, and the vendored sldl binary into
this repo (source /opt/sldl left untouched). Removes all docker exec/docker
compose dependencies now that beets and sldl run in-process/as a subprocess
of this container instead of via soulbeet/on-demand sldl containers.
Replaces hardcoded host paths, Navidrome credentials, and Spotify credential
sourcing with env-var-driven paths and shared credential loaders. Adds
Dockerfile, entrypoint.sh, requirements.txt, docker-compose.snippet.yml, and
the initial app DB schema.

pipeline/configs/_template.conf

@@ -0,0 +1,72 @@
+# Template for per-playlist sldl configs (sldl 2.6.0.0).
+# Flags verified against `sldl --help` output.
+#
+# sldl runs as a subprocess inside the alembic container (same container as
+# beets, on gluetun's network namespace for VPN-routed Soulseek P2P).
+
+# ==== Soulseek credentials ====
+# Substituted by the app's credential_service (not regen.sh) whenever the
+# soulseek secret is saved/updated — every rendered <playlist>.conf gets
+# re-patched at that point, independent of playlist add/remove.
+user = SOULSEEK_USER
+pass = SOULSEEK_PASS
+
+# ==== Spotify API credentials ====
+# Substituted by credential_service the same way, on the spotify secret.
+spotify-id = SPOTIFY_CLIENT_ID
+spotify-secret = SPOTIFY_CLIENT_SECRET
+
+# ==== Input (Spotify playlist URL) ====
+input = SPOTIFY_URL
+input-type = spotify
+
+# ==== Output paths ====
+# SLDL_DROPBOX_ROOT is substituted by regen.sh at render time from
+# $MUSIC_DATA_DIR (sldl's own config format has no env-var expansion).
+path = SLDL_DROPBOX_ROOT/PLAYLIST_NAME
+playlist-path = SLDL_DROPBOX_ROOT/PLAYLIST_NAME/_sldl.m3u8
+write-playlist = true
+
+# ==== Naming ====
+name-format = {artist} - {title}
+
+# ==== Concurrent downloads ====
+# Higher values download from more peers simultaneously.
+# Each peer is usually ~100-500 KB/s, so 10 concurrent ≈ 1-5 MB/s total.
+# Bandwidth isn't the bottleneck on Soulseek - peer availability is.
+concurrent-downloads = 10
+
+# ==== Search behavior ====
+fast-search = true
+search-timeout = 60000
+max-stale-time = 50000
+searches-per-time = 34
+searches-renew-time = 220
+
+# ==== Soulseek listen port ====
+# Picking a port that:
+#   - is below Linux's ephemeral range (32768-60999), so the OS won't auto-pick
+#     it for slskd's outbound peer connections;
+#   - is NOT one of slskd's bound ports inside gluetun (slskd uses 5030 HTTP,
+#     5031 HTTPS, 50300 Soulseek listen);
+#   - is NOT used by any other gluetun-network container (qbittorrent: 6881,
+#     shelfmark: 8084).
+# 9876 fits all three.
+listen-port = 9876
+
+# ==== Quality hard filters (strict - files not matching are rejected) ====
+format = flac,mp3
+min-bitrate = 320
+
+# ==== Quality preferences (soft - controls ranking among accepted files) ====
+pref-format = flac,wav,mp3
+pref-min-bitrate = 320
+pref-max-bitrate = 2500
+
+# ==== Strict filtering (hard - rejects files that don't match) ====
+strict-title = true
+strict-artist = true
+
+# ==== Misc ====
+verbose = true
+no-browse-folder = true